Apple Mac OS X PPP Authentication Credentials Disclosure Vulnerability

Bugtraq ID:	3753
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 28 2001 12:00AM
Updated:	Dec 28 2001 12:00AM
Credit:	Discovered by Loukas Kalenderidis <[email protected]>.
Vulnerable:	Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0
Not Vulnerable:

Apple Mac OS X PPP Authentication Credentials Disclosure Vulnerability

An issue has been reported in Mac OS X which could disclose the authentication information for a PPP connection.

If a user has established a PPP connection, executing a ps command will not only display the information about current processes running, but will disclose the PPP username and password for Internet Connect.

Apple Mac OS X PPP Authentication Credentials Disclosure Vulnerability

No exploit is required.

Apple Mac OS X PPP Authentication Credentials Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Apple Mac OS X PPP Authentication Credentials Disclosure Vulnerability

References:

• MacOSX ppp (Macsecurity.org)